> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigate alerts with AI investigations

> Learn how AI investigations correlate telemetry, test hypotheses, and produce an evidence-backed report for an alert or dashboard panel.

> [!NOTE]
>
> This feature isn't available to all Palo Alto Networks Cortex XCOR users and
> might not be visible in your app. For information about enabling this feature in your
> environment, contact [Cortex XCOR Support](/support.md).

An *investigation* is an autonomous analysis of a systemic problem indicated by your
data. Starting from an [alert](/investigate/alerts) or a
[dashboard panel](/observe/dashboards/panels), an AI agent queries your
[metrics, events, logs, and traces](/overview/types), forms competing explanations,
and tests each one against your data. It then produces findings with a leading
hypothesis and the evidence behind it.

An investigation doesn't replace your judgment. It retrieves and correlates data
first and provides you with an initial investigation, and it shows each query it ran
so you can verify each claim.

> [!WARNING]
>
> Generative AI features can produce incorrect results, hallucinate data, and deliver
> inaccurate analysis. Use generative AI features with care, and independently verify
> all information produced by generative AI tools before applying it.
>
> Certain prompts, data, or other inputs might produce irrelevant content. Don't rely on
> generative AI features or responses for any uses that exceed their designed scope.

## What an investigation produces

Every investigation produces three sections, described in detail in
[Read an investigation](/investigate/investigations/reports.md):

* **Context**: The established context at the start of the investigation, including
  when and what triggered the investigation.
* **Reasoning**: Competing explanations that each include a causal chain, the
  observations that correlate with it, and the questions it can't yet answer. A
  second tab lists the agent tasks that produced those findings.
* **Findings**: A leading explanation, recommended actions, and the supporting
  evidence, as a set of claims you can expand to review the underlying data.

## How an investigation runs

An orchestrating agent plans a set of tasks, dispatches them to sub-agents that run
concurrently, waits for the results, and uses what it
learned to plan the next round. The loop continues until the agent has enough
evidence to produce findings, or until further work stops producing new findings.

```mermaid theme={null}
flowchart TD
    accTitle: The investigation loop
    accDescr: An orchestrating agent plans tasks, dispatches concurrent sub-agents that query telemetry, collects their findings, and either plans another round of tasks or finalizes its findings.

    S[Alert or dashboard panel] --> P[Agent plans tasks]
    P --> D[Sub-agents query telemetry concurrently]
    D --> C[Agent collects and reviews findings]
    C --> Q{Enough evidence?}
    Q -->|No| P
    Q -->|Yes| R[Report findings]
```

Each sub-agent works on one bounded question against one data source. For example, one agent
searches logs for a service while another compares a metric against its recent baseline.
Because they run concurrently, an investigation covers more ground than a
sequential set of manual queries.

An investigation typically takes a few minutes and continues once started. If you manually
initiate an investigation, it continues even if you navigate away from the investigations interface.
Investigations that [start automatically](/investigate/investigations/automatic-investigations.md)
might be completed before you open the alert.

## Where investigations appear

The following table lists the places an investigation appears in Cortex XCOR:

| Interface | Functionality |
| - | - |
| [Alert details page](/investigate/alerts/alert-details.md) | An investigation card with the current status and summary, linking to the full findings |
| **Investigations**, under **Alerting** | Each of your tenant's investigation, with filters by outcome and time range |
| [Operator](/navigate/operator) | An investigation card that tracks an investigation's progress |
| Investigation page | The full process, findings, its follow-ups, and suggested actions |

To start an investigation from each interface, see
[Start an investigation](/investigate/investigations/start.md).

## What investigations read

An investigation queries the telemetry and configuration with the same permissions
as your account. It can't access data that your account can't access.

Its findings draw on:

* **Telemetry**: Metrics, [change events](/overview/types/change-events.md), logs, and
  traces. This includes cross-telemetry correlations, such as moving from a metric label
  to the matching log query.
* **Alert and monitor configuration**: The monitor query and condition, and the
  [dashboards and log queries annotated on the monitor](/investigate/alerts/monitors/annotation-links.md).
* **Service context**: The [services](/observe/services) defined in your tenant and
  their related telemetry.
* **Past incidents**: [Resolution notes](/investigate/investigations/feedback.md#write-resolution-notes)
  from earlier alerts on the same monitor or SLO.

Investigation quality scales with how much data is available. For habits that
can improve investigations' performance, see
[Improve investigation quality](/investigate/investigations/feedback.md).

## Investigations and Operator

Investigations and [Operator](/navigate/operator) are separate
[generative AI-powered features](/overview/generative-ai.md) designed to work together.

* Operator is a conversational assistant that can answer a question about your data
  in seconds, can create or modify resources, and might require your interactive input
  to complete a task or fully answer a query.
* An investigation is an autonomous background analysis that produces a durable,
  shareable report. Unlike an Operator conversation, Cortex XCOR can also start and
  complete an investigation autonomously.

For a quick answer to a question, ask Operator. To generate a full correlation pass
across your telemetry, start an investigation. Operator can start an investigation for you
and monitor it while you continue working, and you can ask Operator follow-up questions about a completed investigation.


## Related topics

- [Start an investigation](/investigate/investigations/start.md)
- [Investigate alerts automatically](/investigate/investigations/automatic-investigations.md)
- [Read an investigation](/investigate/investigations/reports.md)
- [Alert details](/investigate/alerts/alert-details.md)
- [Improve investigation quality](/investigate/investigations/feedback.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.